e8bf04060930c079b23d7e221fab7876fd737c0c5d51cb4add878f07be47307f

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-03-2023 12:35

Target

2584-135-0x0000000002D80000-0x0000000002D8D000-memory.dll
Size

52KB
MD5

35784e4148c8123ab6350fd547f707cb
SHA1

ab1328ef32d64d4c0280ccec867e18c102b54e91
SHA256

e8bf04060930c079b23d7e221fab7876fd737c0c5d51cb4add878f07be47307f
SHA512

684647f697e1047006f3b8ae97f9b13620e16df9da0f00f9e1f298f219fa7d7f96db255188716efbdc48496fd526f80dfda9e1b93027d0dab2c45595cbc126e9
SSDEEP

768:p8W4k2qVDnskVGtk/E43YCst5+H5LIISOvwUZEYvUIlOKdMxhK3D1Gc:p8WV2qRqk/EmY7wpIgN8IAKdMOD1Gc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	1856	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1856	1368	rundll32.exe	28
PID 1368 wrote to memory of 1856	1368	rundll32.exe	28
PID 1368 wrote to memory of 1856	1368	rundll32.exe	28
PID 1368 wrote to memory of 1856	1368	rundll32.exe	28
PID 1368 wrote to memory of 1856	1368	rundll32.exe	28
PID 1368 wrote to memory of 1856	1368	rundll32.exe	28
PID 1368 wrote to memory of 1856	1368	rundll32.exe	28
PID 1856 wrote to memory of 1880	1856	rundll32.exe	29
PID 1856 wrote to memory of 1880	1856	rundll32.exe	29
PID 1856 wrote to memory of 1880	1856	rundll32.exe	29
PID 1856 wrote to memory of 1880	1856	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2584-135-0x0000000002D80000-0x0000000002D8D000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2584-135-0x0000000002D80000-0x0000000002D8D000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 196
    3⤵
    - Program crash
    PID:1880